The present invention relates generally to remote access of digital data and services and, more particularly to a service provisioning system architecture for providing universal stateless digital and computer services.
The configuration of corporate computer systems has evolved over the past fifty ears since the introduction of the software programmable digital computer. In the first multi-user systems, some number of users, such as corporate employees, etc., accessed the processing power of one or more centrally located mainframe computers using “dumb terminals” connected to the mainframe computers via a communications network. The mainframe computers provided all processing power and data storage facilities. The dumb terminal was used for and limited to inputting data to the mainframe computers and displaying output data generated by the mainframe computers. That is, the dumb terminal did not have the capability of processing or storing data locally. Essentially, the dumb terminal was useless unless it was connected to the mainframe computers via a dedicated, mainframe and installation-specific communications network.
However, the high cost associated with acquiring and maintaining the mainframe computers fueled the availability and popularity of the desktop or personal computer (“PC”) in the 1980s. Initially configured as a stand-alone platform, a PC is a self contained computing system where all processing is performed locally, and all applications and data are executed and stored locally. The relatively low cost of PCs enabled single users and small businesses to readily acquire and utilize the processing power of the PCs instead of relying on massive, centrally located mainframe systems. However, users could not easily share data with other users since their PCs were not part of a centralized network and did not necessarily use the same operating system. Also, since each PC needed its own local copy of any software to be executed, incompatible versions of the same software application in different personal computers prevented users from communicating and sharing data with each other.
These connectivity and compatibility problems with the standalone PCs gave rise to client/server systems. The PCs (or clients) were connected to each other via a private communications network, such as a corporate network, and to a common server storing data and applications. The server maintains the common data and provides copies of the data to the clients upon request. However, since the client/server systems rely on the processing power of the PC, the hardware and software components of each PC of a client/server network must be constantly synchronized and therefore upgraded. In many corporate settings, PCs are numerous and widely distributed throughout and among diverse locations. Depending on the age and type of the PC system, certain hardware components, such as microprocessors, random access memory (RAM), hard disk devices, etc., can be upgraded or replaced without replacing the entire PC system. However, even when it is feasible to upgrade the PC systems, the cost of upgrading thousands of PC systems can be staggering.
When the PC system can no longer be upgraded, the entire system must be replaced. For example, newer versions of software applications or operating systems may require hardware capabilities that cannot be satisfied by existing PC systems. Generally, a PC system is considered to be obsolete in three to five years, thereby necessitating costly replacement of thousands of PCs as often as every three years.
In addition to the cost of purchasing new hardware and software, the cost of resolving the software and hardware compatibility problems in the client/server system can be substantial. For example, many software applications are not readily backwards compatible, thereby imposing a significant burden on the corporations to maintain compatible versions of software applications on all PC systems. The administrative effort and the cost to upgrade each system, provide licensed copies of software, install and maintain the software is the largest portion of the recurring costs of running a client/server network in a corporation. Even with remote administration capabilities, the tracking and cataloging of software applications can be very onerous.
Installation of new software also exposes the corporate user to security risks. The integrity and security of the corporate network can be easily breached by hackers or disrupted partially or in total by inadvertent or intentional introduction of computer viruses when a user installs or downloads unauthorized and even authorized software application or files.
Individuals who are away from their office often have a continuing need to gain access to their corporate networks. They may need to access files, e-mails, applications and programs running on their “desktop”, etc. (“Desktop” refers to a top level, local graphical user interface environment customized by a user to display and provide access to data, folders and applications.) One approach is to use laptop personal computers to enable users to access the corporate network to remotely access their files and e-mails. That is, if appropriate communications software is installed on each client laptop PC, the users can remotely access emails and the corporate network to transfer files from/to the network server through a dial-up telephone line (or a broadband connection, such as a digital subscriber line (DSL), T1, cable, etc.). All application programs reside and locally execute on the local client laptop PC. While this approach is simple, it necessitates that each and every such software application be installed, configured and then maintained on each laptop PC. Consequently, over time, this approach, particularly in view of the on-going support costs of the installed software applications, can become quite expensive.
Another approach uses a traditional virtual private network (VPN) to provide wide area network (WAN) connectivity from a remote user location to a central corporate local area network (LAN). A VPN WAN connection can implement an Open System Interconnection (OS) layer 2 extension between the LAN and the remote user location. A remote client PC connected through a VPN to a LAN appears as if it is directly connected to the LAN. However, a VPN connection requires expensive VPN termination equipment (or a client-site VPN router) located at each end of the connection, or VPN client software installed and configured at the client machine. In either case, the VPN terminator provides layer 2 packet processing as well as appropriate packet encryption/decryption functionality. Although either PC operating system or client based VPN software can mitigate the cost of the VPN terminator, it both require considerable packet processing to assemble and disassemble packets, imposing a significant processing burden on the PC. Accordingly, a separate dedicated VPM terminator at the remote user location is often required to support VPN connectivity with required levels of security and reliability without imposing undue processing load on the client PC itself. Thus VPN equipment is not only expensive, but tedious to configure and costly to administer and maintain.
In all of the above cases, sensitive corporate data are transferred and duplicated between the secure corporate network and the PC/laptop. Once data is downloaded and physically copied, no access or transport security system can prevent unauthorized, uncontrolled distribution and misuse of the data, which happens without the knowledge of the legitimate data owner.
Still another approach to extending the office environment to remote user location utilizes an application service provider (ASP) model requiring the installation of specialized server software in the network server, such as Citrix Corporation's MetaFrame® software using independent computing architecture (ICA®) protocol. The network server situated on the LAN would function as an ASP by hosting multiple virtual machines, to various different remotely located client PCs. Alternatively, Microsoft Corporation's Windows® Terminal Services (WTS) using remote desktop protocol (RDP) can be utilized to provide multiple virtual machines. However, both the MetaFrame® and WTS software impose considerable processing load on the client PC, and are vulnerable to network faults and security breaches, such as “man-in-the-middle” attacks. Additionally, the ASP-based approach, at best, provides a limited remote execution functionality. The prior art systems were designed and developed to overcome the bandwidth limitations of the prior communications networks. Current technological advances have dramatically increased the bandwidth of the communications network. The network bandwidth is increasing faster than microprocessor speed and doubling approximately every nine months, thereby reducing the value of the prior art systems and technologies, effectively rendering them obsolete. In view of the shortcomings of the prior systems and networks, it is desirable to provide a system and method for enabling a user to securely access his client machine, including desktop, software applications, email, data files, etc., from anywhere in the world as if he is still in the office without compromising security or investing in new hardware/software infrastructure.
Managing information systems efficiently has never been more difficult or more essential for success. As the cost of ownership for desktop systems escalates, corporations need ways to reduce purchase and upgrade costs, administration and maintenance expenses. However, these savings can't result in a loss of functionality or performance. An unrestricted access to high performance applications remains a critical requirement in managing information systems efficiently. Thus, it is desirable to have a service provisioning system architecture that can provide an unrestricted, native and secure remote access without modifying or with minimal changes to its existing hardware and software infrastructure.